←back to thread

OpenJDK Authorization

(github.com)
16 points pfirmst | 3 comments | 19 Nov 24 23:51 UTC | HN request time: 1.13s | source
Show context
pfirmst ◴[19 Nov 24 23:51 UTC] No.42189343[source]▶
Looking for interested parties to assist maintaining a fork of OpenJDK with authorization. Note this isn't for sandboxing untrusted code but instead only allow loading trusted code and automate generation of principle of least privilege policy files for auditing with user Principal's and Code Signer's.
replies(2): >>42190229 #>>42190244 #
1. mdaniel ◴[20 Nov 24 02:16 UTC] No.42190244[source]▶
Since I am not the target audience for this, pardon me if this seems like a silly question, but wouldn't just using a custom ClassLoader or even an Agent get this done, without having to full-on fork the JDK?
replies(2): >>42193507 #>>42202170 #
2. bzzzt ◴[20 Nov 24 12:53 UTC] No.42193507[source]▶
This project looks like it's trying to conserve the old SecurityManager (from the Java Applet/Webstart days) implementation that's been removed from the OpenJDK tree. The motivation is on the website: only a very small number of people still use this, but if you're one of them and have a legacy application that depends on the old behavior you don't want too many changes.
3. pfirmst ◴[21 Nov 24 08:13 UTC] No.42202170[source]▶
It requires low level hooks and support from within the JVM, using agents is brittle and difficult to secure, the simplest solution is just to fork. I did spend some time investigating these methods before making the decision.

https://github.com/pfirmstone/HighPerformanceSecurity